McKesson_DIN_PACS_JEFO_for_Navy_Maint_5.29.18_Redacted.pdf

JUSTIFICATION FOR EXCEPTION TO FAIR OPPORTUNITY (JEFO)

1. Defense Logistics Agency (DLA) Troop Support, Medical Supply Chain, Capital Equipment Division, is the contracting activity.

2. This justification is for the purchase of annual Digital Imaging Network-Picture Archive and Communication Systems (DIN-PACS) maintenance for the McKesson Technologies LLC (McKesson) PACS located at Camp Pendleton, Twenty-nine Palms and Port Hueneme on a sole source basis.

3. This purchase of maintenance service is available on McKesson’s DIN-PACS IV contract SPE2D1-18-D-0006, which expires December 14, 2022. The total estimated dollar value is $375,200.00.

4. The authority under the Multiple-Award Schedule Program waiving the competition requirements is FAR 16.505(b)(2)(i)(B), only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized. McKesson is the only vendor who is able to perform maintenance services on its McKesson DIN-PACS and ensure the installed systems’ performance in accordance with the terms and conditions of the contract.

DIN-PACS is a commercial network of high technology digital medical devices regulated by the Food and Drug Administration (FDA). They are designed to acquire, transmit, display and store diagnostic imaging studies and related information. DIN-PACS provides for tele-radiology, or the electronic communication of medical radiology images and results.

The DIN-PACS IV Program is the fourth generation multiple award contract program for DIN- PACS. The DIN-PACS IV contracts are multiple award contracts. Contracts are awarded for a vendor’s complete commercial product offering usually consisting of DIN-PACS, turnkey installation, training and maintenance services. Delivery orders for new DIN-PACS are highly competitive, with all vendors being given a fair opportunity to compete for all requirements;

however, the purchase of maintenance service for DIN-PACS is not competitive. McKesson’s DIN-PACS systems include proprietary hardware and software. The proprietary clinical software used in McKesson’s DIN-PACS requires licenses; therefore, only McKesson can provide licenses for the software updates that are covered under a warranty. Updates and upgrades to system software can only be provided by McKesson as these are FDA approved medical devices. These updates/upgrades are essential to maintain the near 100 percent uptime requirements under the DIN-PACS contract, and can only be provided by McKesson, the manufacturer of the system.

Per contract requirements for DoD Information Assurance/Information Security Requirements, all DIN-PACS are required to meet DoD Cybersecurity and individual Military Service Information Assurance (IA) requirements. Cybersecurity and Service specific IA requirements mandate that equipment must receive an Authorization to Operate (ATO) prior to being able to be connected to any DoD network. Vendors are required to continuously update system software and services in response to information assurance security threats and alerts. All follow-on DIN-PACS maintenance services agreements require the same vendor receiving the award for the original device or system to maintain the Authority to Operate (ATO) for the DIN-PACS and ensure the system is in compliance with the Department of Defense (DoD) Information Assurance Vulnerability Management (IAVM) Program. DoD requirements are established in DoD Instruction 8500.01 (DoD Cybersecurity) and DoD Instruction 8510.01 (Risk Management Framework), and address the requirements for managing the life-cycle cybersecurity risk to DoD IT. Vendor responses to a request for information relating to these requirements confirm that no third-party vendor is capable of ensuring upkeep of the ATO for a given DIN-PACS, or ensuring compliance with the DoD IAVM Program, as only the Original Equipment Manufacturer (OEM) has this ability. McKesson, the manufacturer of the DIN-PACS, is responsible for all system information security certifications, testing and on-going IA and security updates and patches. Accordingly, only McKesson can maintain the critical security status of the DIN-PACS on an on-going basis under yearly maintenance programs. DINPACS are FDA approved medical devices, and changes to the software/hardware on the equipment to meet DoD Cybersecurity requirements, updates or patches must be thoroughly tested by the manufacturer prior to being applied to a medical system; therefore, only McKesson can do this.

5. The McKesson DIN-PACS IV contract includes fixed prices for annual maintenance service programs. These prices were determined fair and reasonable at time of contract award based on a comparison to McKesson's top commercial customer pricing and discount policies and sales to similarly situated commercial customers. Based on the above facts, the contracting officer has determined that the anticipated cost to the Government for each service order will be fair and reasonable.

6. Market research has been conducted during the DIN-PACS III and IV acquisitions from January 2010 through the present. It is an ongoing process under the DIN-PACS program, as the vendors and the customers keep DLA Troop Support abreast of product changes and enhancements to the functionality of the products. Further, DLA Troop Support periodically publishes formal requests for information, queries the Internet for catalogs and product literature and meets periodically with vendors regarding new product releases. DLA Troop Support issued a Request for Information (RFI) to all program contract holders and pending contract holders on October 11, 2017. The purpose of the RFI was to determine if the DIN-PACS vendors could offer multi-vendor maintenance, what equipment they support, how they provide system updates/upgrades, how they provide remote diagnostics for other OEM’s systems, whether they use OEM trained/certified technicians, if they subcontract out service, what types of repair parts they use, and how they would meet DoD cybersecurity requirements under Continuous Risk Management (maintain other OEM’s ATOs and meet IAVM requirements). Responses were received by October 20, 2017 from all of the vendors that were contacted which included Agfa Healthcare Corporation, Carestream Health, Inc., Fujifilm Medical Systems U.S.A., ScImage, Inc. and McKesson Technologies, LLC. The responses confirmed that only the OEM can maintain the DIN-PACS and multi-vendor maintenance was not sold commercially. DIN-PACS vendors cannot offer multi-vendor maintenance due to the proprietary software, software licensing and requirement to maintain ATOs and meet IAVM requirements. Thus, the market research conducted supports that no other DIN-PACS vendor is capable of performing maintenance service on McKesson DIN-PACS systems. There is no expectation that this situation will change during the term of this contract.

7. There are no other facts supporting the use of this JEFO.

8. DIN-PACS vendors have the opportunity to add products that fall within the scope of the DIN- PACS contract at any time; however, currently there are no other known DIN-PACS vendors that would be able to offer a maintenance, service and support program for an existing McKesson DIN-PACS unit.

9. As the Contracting Officer, I hereby certify that the information contained in this justification is accurate and complete to the best of my knowledge.

Date KATIE HUGHES

Contracting Officer

I hereby certify that the requirements which form the basis of this justification are accurate, that these supplies meet the Government’s minimum needs and that this justification is accurate and complete to the best of my knowledge.

Date MERRILL ADAMS

Biomedical Engineer

HUGHES.KATIE.128

4072096

Digitally signed by

HUGHES.KATIE.1284072096

Date: 2018.05.29 09:54:52 -04'00'

ADAMS.MERRILL.J.123077

Digitally signed by

ADAMS.MERRILL.J.1230778570

Date: 2018.05.29 11:11:05 -04'00'